Dependabot, a popular tool for managing dependencies, has introduced a default package cooldown period of three days [1]. This means that Dependabot will wait until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown period is designed to reduce the risk of supply chain attacks, where a compromised or broken version of a dependency can be pushed to a repository before maintainers and the community have a chance to review it [2]. The cooldown feature is configurable, and users can set a different window or opt out entirely by using the cooldown option in their .github/dependabot.yml file [3].

This feature is available across all supported ecosystems on github.com and will take effect in GitHub Enterprise Server (GHES) 3.23 [4]. The default cooldown period only applies to version updates, and security updates will still be opened immediately [5]. This change is part of GitHub's efforts to improve supply chain security, and users can learn more about Dependabot cooldowns in the official documentation [6].

Sources

  1. https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown
  2. https://github.blog/changelog/2025-07-01-dependabot-supports-configuration-of-a-minimum-package-age
  3. https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-
  4. https://github.com/dependabot/dependabot-core/discussions/15368
  5. https://developer-portal.service.justice.gov.uk/guidelines/dependabot-guidelines
  6. https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown-