🟡 Medium | Source: The Hacker News
GitHub has introduced a default three-day cooldown period in Dependabot, delaying automated pull requests for newly published package versions. This gives time for the security community to identify poisoned or malicious packages before they are automatically adopted into codebases. The cooldown is configurable via dependabot.yml for teams with different risk tolerances.
Security Architect’s Take: Review your organisation’s dependabot.yml configurations and consider whether the default three-day cooldown is appropriate or whether a longer window — such as seven days — better balances security and velocity for your projects. Pair this with private registry mirroring and package integrity checks to further reduce supply chain risk.
Original advisory: GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption