GitHub delays Dependabot version updates to keep poisoned packages out

GitHub is adding a default three-day cooldown before Dependabot opens pull requests for new package versions, aimed at supply chain attacks where a poisoned release spreads through automated updates before anyone catches it. Security updates that answer a known advisory still ship immediately; only routine version updates wait. GitHub points to the September 2025 compromise of chalk, debug, and other packages, whose crypto-stealing versions were live for roughly two hours, and notes its advisory database logged more than 6,500 npm malware advisories in the year to May 2026, around eighteen a day. Most malicious releases are caught within hours, so a short delay filters out the majority.

Check

If you use Dependabot, confirm the cooldown is enabled and consider tuning the window in dependabot.yml, and apply similar delay logic to any other automated dependency tooling you run.

Affected

Projects with automated dependency updates that pull new releases immediately; a poisoned version of a popular package can reach reviewers and installs during the short window before it is caught and yanked.

Fix

Adopt a cooldown on version updates while keeping security fixes immediate, pin and verify dependencies, review update pull requests rather than auto-merging, and monitor for advisories on packages you rely on.