[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgZJNOq0Fse5V-ek46cVpNTZBYx-i7FQCOFfUegn3L74":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"57f6c08c-6a91-4285-b508-981d26154c58","GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption","github-adds-3-day-dependabot-cooldown-to-limit-poisoned-package-adoption-c2fbf6","GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. \"The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project,\" the Microsoft-owned subsidiary said. According to GitHub, the","GitHub has introduced a new default three-day cooldown period for Dependabot version updates. This change aims to mitigate supply chain attacks where threat actors push poisoned package versions that are quickly adopted before being removed. While security updates will still be pushed immediately, the cooldown for regular version updates provides a buffer to identify and mitigate malicious packages.","GitHub Dependabot adds a 3-day cooldown for version updates to prevent poisoned package adoption.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fgithub-adds-3-day-dependabot-cooldown.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiFpE4BZgV3wILI8fonm9742zR85yLmBdM2ExXv-uTUS1StV04ZlNVVIwV6FjjhYLZUAFk-DAIInwp3mlXa2W2xekDA_EqSl1UiHrKCgocsjhVAKlvCD48QnlVdUdCIQia7T4ilS65ZFptdi_wox0Q9brVTdpoqDNTvpCjg0D6BslyCAPRzY7QMyUoYNkv-\u002Fs1600\u002Fgitbot.jpg","2026-07-27T08:01:23+00:00","2026-07-27T10:00:19.67504+00:00",7,[17,20,23],{"name":18,"type":19},"Dependabot","product",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":22},"Microsoft","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[24,21,18],{"controls":46,"vendors":104},[47,76],{"slug":48,"name":49,"problem":50,"products":51},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":77,"name":78,"problem":79,"products":80},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":98,"vendor_name":21,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",[105],{"slug":98,"name":21,"logo_path":99,"roles":106},[107],"reported_by",{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":121},"githubs-dependabot-cooldown-tackles-poisoned-package-risk","GitHub's Dependabot Cooldown Tackles Poisoned Package Risk","Supply chain attacks increasingly exploit automated dependency update tools like Dependabot, which can rapidly pull malicious package versions into production codebases before the threat is detected and removed. Threat actors deliberately publish poisoned packages, knowing that automation will propagate them widely within hours. GitHub's three-day cooldown for non-security updates creates a critical observation window, allowing the community and security tooling to flag malicious releases before they are widely adopted. This incident highlights how convenience features in the software supply chain can become attack vectors if not governed with appropriate safeguards. Organizations that blindly trust automated dependency updates without review policies face significant risk of introducing compromised code.",[113,114,115,116,117,118,119,120],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161r1: Supply Chain Risk Management Practices","NIST SSDF PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","SLSA Supply Chain Levels for Software Artifacts (SLSA) Framework","OWASP A06:2021 – Vulnerable and Outdated Components",{}]