GitHub introduced a 3-day cooldown on Dependabot non-security version update pull requests, providing vulnerability scanners a detection window to catch poisoned packages before automated merging.

Key Takeaways

  • ✓Cooldown applies exclusively to non-security bumps; critical security CVE patches trigger immediately;
  • ✓Grants security scanners and community maintainers a 72-hour window to identify and revoke malicious releases;
  • ✓GitHub Security published detailed supply-chain guidelines explaining the necessity of update buffers.
🧭

Turn your technical choice into a development budget

Compare 40 dev plans & simulate token costs vs $20/mo subscriptions

Action HubReady to adopt this in production?

Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.

Up NextOpenAI gives ChatGPT Pro and Business subscribers up to $500 a month in API credits to build apps and agents
Read Now→