GitHub has introduced a new cooldown mechanism for Dependabot that will delay automated version update pull requests for at least three days after a new software release is published. The Microsoft owned platform said the feature is intended to reduce the risk of software projects automatically adopting malicious or compromised packages before security researchers or maintainers have time to identify and remove them. According to GitHub, the new behavior applies by default to version updates that keep software dependencies current, while developers can still customize the waiting period through the dependabot.yml configuration file to match the requirements of their own projects. The company emphasized that security related updates will not be delayed, allowing Dependabot to continue issuing alerts and creating pull requests immediately whenever a patched version is available for a known vulnerability.
GitHub explained that the three day cooldown is designed to address situations in which attackers successfully publish a poisoned version of a widely used software package. In such incidents, downstream projects may automatically adopt the compromised package before it is detected and removed from the package registry. Although these malicious releases often remain available only for a short period, they can still affect a large number of projects through automated dependency updates, significantly increasing the impact of a software supply chain attack. GitHub said the selected three day default represents a balanced approach that provides enough time for suspicious releases to be identified without unnecessarily delaying legitimate software updates. The company stated that this timeframe moves projects beyond the period in which many of these attacks are typically discovered while still allowing developers to receive updates within a reasonable time.
Despite introducing the new protection, GitHub stressed that the cooldown should be viewed as only one layer within a broader software supply chain security strategy. The company encouraged development teams to continue following established security practices such as pinning dependencies through lockfiles, disabling installation scripts in continuous integration environments where appropriate, limiting token permissions within build pipelines, and carefully reviewing dependency updates before merging them into production code. GitHub also acknowledged that the new mechanism is intended to defend against a specific type of attack involving malicious package releases that spread rapidly before being removed. It noted that the delay offers limited protection against more advanced threats, including compromised build systems, intentionally malicious maintainers, or backdoors inserted into software releases that remain undetected for extended periods.
The introduction of the default cooldown follows similar security measures adopted across several software package ecosystems over the past year, including Microsoft Visual Studio Code, Ruby, Bun, npm, pnpm, and Yarn. GitHub’s announcement also comes as the maintainers of Python Package Index have revealed plans to prevent package maintainers from adding new files to an existing package release once 14 days have passed since its publication. According to PyPI, the measure is intended to reduce the risk of attackers compromising publishing credentials or automated release workflows to inject malicious code into older and widely trusted software versions. Together, these changes reflect the growing emphasis across the software development ecosystem on strengthening supply chain security and reducing opportunities for attackers to distribute malicious packages through trusted development platforms.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
