GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates
GitHub just added a 3-day 'cooldown' to Dependabot. Here's why that matters for your supply chain security.
Why it matters
GitHub's new Dependabot cooldown policy addresses software supply chain risk by delaying dependency updates to allow malicious releases to be caught and removed before integration—a practical security-first product shift that impacts how AI/ML teams manage their infrastructure dependencies.
The key facts
8 to knowDependabot now waits 3 days before suggesting version upgrades
Policy targets identification of malicious releases before integration
Default behavior change (not opt-in) increases adoption of safer dependency practices
Relevant to ML ops pipelines and infrastructure security for AI teams
Dependabot now waits 3 days before opening pull requests for new dependency versions
Policy targets detection and removal of malicious releases before integration
Applies to version update suggestions across the ecosystem
Affects development workflows for teams building AI/ML applications
Go to the source
InfoQ AI/MLinfoq.com
Publisher excerpt: Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades, thus increasing the likelihood that malicious releases are identified and removed before they can be integrated. By Sergio De Simone