GitHub introduces 3‑day Dependabot cooldown to curb supply‑chain attacks

GitHub has enabled a default three‑day delay for Dependabot version‑update pull requests. The pause gives package maintainers, security researchers and automated scanners extra time to spot and remove malicious releases before they are automatically merged into projects. Security‑focused updates will still be issued immediately.

The change follows recent high‑profile supply‑chain incidents, including compromised npm maintainer accounts that published trojanized versions of popular libraries such as chalk, debug, axios and others. GitHub’s mitigation is paired with similar time‑based defenses added by the Python Package Index (PyPI), inserting latency thresholds and verification windows to block automated dependency‑confusion and typosquatting attacks.

By adding a mandatory observation window for newly published packages, the combined GitHub‑PyPI safeguards aim to limit the blast radius of malicious code in continuous‑integration pipelines, giving organizations more opportunity to detect and block harmful artifacts before they reach production environments.