Dependabot Security Cooldown: Slowing Down to Stay Safe
The Dependabot security cooldown is a time‑based delay that postpones non‑security dependency update pull requests so researchers can spot poisoned packages and supply chain malware before developers install them, while still letting urgent security fixes ship immediately to protect against known vulnerabilities that attackers might exploit. GitHub’s new three‑day default cooldown for Dependabot version updates is the rare security change that does exactly what modern GitHub dependency management needs: it slows the parts that create risk while keeping the safety‑critical path fast. This is not GitHub being cautious; it is GitHub admitting that our obsession with instant updates has become an attack surface. If you care about poisoned package detection, you should welcome this speed bump, not fight it.
The Threat: Fast Bots, Faster Supply Chain Malware
Automated update tools were built for speed: watch the registry, see a new release, open a pull request immediately. In September 2025, that speed enabled a textbook supply chain malware incident, when an attacker phished an npm maintainer’s credentials and shipped poisoned versions of chalk, debug, and about a dozen other packages together downloaded more than 2 billion times a week. The injected code rewrote cryptocurrency wallet addresses in browser apps loading those packages, and the bad versions stayed live for about two hours before the community removed them. That two‑hour window is enough for Dependabot to propose the malicious versions and place them in front of reviewers. GitHub’s Advisory Database has logged over 6,500 npm malware advisories in a single year—about 18 new malicious packages a day—so this is not a rare edge case, it is daily background noise.
Why a Three-Day Cooldown Is the Right Compromise
GitHub’s change is simple but opinionated: for non‑security version bumps, Dependabot now waits at least three days after a release before opening a pull request. Security updates are exempt; when an advisory lands, Dependabot still opens a pull request immediately, because holding back a known fix would leave a public vulnerability unpatched. This is the core balance: slow down the risky, routine upgrades while keeping the security response path fast. A poisoned build of a popular package usually lives only hours before it is caught and pulled, as seen with compromised versions of Solana web3.js, Axios, and ua‑parser‑js. A cooldown moves your project beyond that early blast radius. According to GitHub, “three days as the default balances two goals: it pushes you past the window where most of these attacks live, and it doesn’t hold your dependencies back longer than necessary.”
Limits of Cooldowns: What This Won’t Save You From
A three‑day wait counters one specific pattern of supply chain attack: a malicious version that ships, spreads quickly, and is removed once detected. It does little against slower, more patient threats. Backdoors planted in legitimate releases and left dormant, intentional maintainer sabotage, or a compromised build system can sit undetected for months. A cooldown will happily let those versions age past the delay and then bring them to your repository. In other words, this is not a silver bullet; it is another layer. The real lesson is strategic: time‑based defenses are best at filtering short‑lived spikes in risk, not long‑arc compromises. Treat the cooldown as a guardrail against sudden poisoned package floods, while assuming that subtle, long‑term supply chain malware will still slip through unless you build other checks around it.
What Development Teams Should Do Now
With the Dependabot security cooldown enabled by default, your first decision is how much to trust it. The cooldown option in dependabot.yml lets you tune the window or set different delays for internal packages and public registries, so treat it as policy, not a magic default. Then, build the rest of your defenses. Pin dependencies with lockfiles so you know exactly what you are deploying. Disable or limit install scripts in CI where possible, cutting off a favorite path for malicious post‑install behavior. Scope tokens in your build pipelines so a single compromised secret cannot poison every project. And, crucially, review Dependabot pull requests before they merge, even after the cooldown. Other ecosystems—from VS Code to package managers like npm, pnpm, Yarn, Ruby, and Bun—are adding similar delays, signaling a clear shift: slow down routine automation enough for humans and scanners to keep up.
