#GitHub's Dependabot now waits 3 days by default before opening pull requests…

InfoQ@techhub.social · 2026-08-03 17:59

#GitHub's Dependabot now waits 3 days by default before opening pull requests for new non-security dependency versions.

The delay gives security scanners and the community more time to detect and remove malicious releases before they're integrated into projects.

Read the full story on InfoQ 👉 https://bit.ly/4xeUgVY

#DevOps #SoftwareSupplyChain #InfoQ

GitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates

Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades, thus increasing the likelihood that malicious releases are identified and removed before they can be integrated.

bit.ly

View original 0 Likes 0 Boosts

Comments (0)

No comments yet.