GitHub has introduced a default three-day cooldown period for Dependabot version updates, aiming to mitigate the risk of projects automatically incorporating malicious packages. This measure addresses a common tactic in software supply chain attacks, where attackers compromise trusted package maintainers’ accounts to distribute harmful updates before detection.
In September 2025, an incident highlighted this vulnerability when attackers gained access to an npm maintainer’s credentials and published malicious versions of widely-used packages like ‘chalk’ and ‘debug’. These compromised packages, downloaded billions of times weekly, contained code that altered cryptocurrency wallet addresses in browser applications, potentially diverting funds to attackers. Although the malicious releases were removed within approximately two hours, automated update systems had already identified and proposed these versions in downstream repositories, posing a significant security risk.
Understanding the 3-Day Cooldown
Dependabot, GitHub’s dependency management tool, performs two primary functions: security updates and version updates. Security updates address known vulnerabilities by creating pull requests for patched versions, while version updates refresh packages when new releases are available, regardless of known security issues. The newly implemented three-day delay applies exclusively to standard version updates, allowing time for potential issues in new releases to surface before integration. Importantly, Dependabot security updates will continue to be issued immediately to ensure prompt patching of disclosed vulnerabilities.
This cooldown period provides package maintainers, security researchers, registry operators, and automated scanning systems additional time to identify and address malicious releases before they reach development teams. While this protection is enabled by default, repository maintainers have the flexibility to adjust the delay through the ‘cooldown’ configuration in the ‘dependabot.yml’ file, tailoring the waiting period to their specific risk tolerance and operational needs.
Context and Implications
The implementation of this cooldown period is a response to the increasing prevalence of supply chain attacks targeting software dependencies. For instance, GitHub’s Advisory Database recorded over 6,500 npm malware advisories in the year ending May 2026, up from approximately 6,200 the previous year, indicating a growing threat landscape. By introducing a default waiting period, GitHub aims to reduce the likelihood of malicious packages being automatically adopted before detection.
However, GitHub emphasizes that cooldowns are not a comprehensive solution for supply chain security. They may not prevent long-term backdoors, malicious behavior from trusted maintainers, or compromises of build and release infrastructure. Therefore, teams are encouraged to implement this feature alongside other security measures, such as lockfiles, manual pull request reviews, restricted CI/CD tokens, and controls that disable dependency install scripts when possible.
This new default adds a layer of protection against rapid package attacks, helping developers avoid placing automatic trust in every newly published version. By allowing time for potential issues to surface, the cooldown period enhances the overall security posture of projects relying on automated dependency management.
