GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub Dependabot adds a 3-day cooldown for version updates to prevent poisoned package adoption.
GitHub has introduced a new default three-day cooldown period for Dependabot version updates. This change aims to mitigate supply chain attacks where threat actors push poisoned package versions that are quickly adopted before being removed. While security updates will still be pushed immediately, the cooldown for regular version updates provides a buffer to identify and mitigate malicious packages.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSupply chain attacks increasingly exploit automated dependency update tools like Dependabot, which can rapidly pull malicious package versions into production codebases before the threat is detected and removed. Threat actors deliberately publish poisoned packages, knowing that automation will propagate them widely within hours. GitHub's three-day cooldown for non-security updates creates a critical observation window, allowing the community and security tooling to flag malicious releases before they are widely adopted. This incident highlights how convenience features in the software supply chain can become attack vectors if not governed with appropriate safeguards. Organizations that blindly trust automated dependency updates without review policies face significant risk of introducing compromised code.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.