GitHub Dependabot Delays Updates by 72 Hours for Security

GitHub has implemented a default three-day cooldown period for Dependabot version updates across all supported ecosystems on github.com, a change that will also arrive in GitHub Enterprise Server 3.23. Under this new policy, the automated tool will wait 72 hours after a non-security package release before generating a pull request. Critical security updates addressing known vulnerabilities will continue to bypass this delay and trigger immediate alerts.

The adjustment addresses a rising tide of rapid supply chain exploits. For instance, a September 2025 phishing attack compromised an npm maintainer, leading to malicious versions of chalk, debug, and roughly a dozen other packages that collectively see over 2 billion weekly downloads. Though the community detected and removed the malware within two hours, aggressive auto-updaters still risked pulling the compromised code. This is part of a broader trend: in the year ending May 2026, the GitHub Advisory Database logged over 6,500 npm malware advisories, averaging about 18 daily, up from roughly 6,200 the previous year.

An analysis of 21 major supply chain incidents between 2018 and 2026—including attacks on axios, Solana web3.js, ua-parser-js, and Ledger Connect Kit—revealed that malicious releases are typically identified and pulled within hours. GitHub developers noted that a three-day window balances security by avoiding the immediate danger zone without unnecessarily stalling dependency updates.

For software engineers, this update introduces a safer default without requiring manual configuration. Developers who want to bypass the delay can modify their dependabot.yml file, setting the default-days parameter to zero under the cooldown block, or customize the window for specific trusted internal packages. While this defense-in-depth measure does not stop sophisticated, dormant backdoors, it significantly reduces exposure to immediate, automated package poisoning.