Dependabot now waits 3 days by default — leave it alone

GitHub changed a default that most teams never configured, and it quietly makes your build safer. Dependabot now waits three days after a package hits the registry before opening a version update pull request. No config required, no opt-in. If you've been auto-merging Dependabot PRs — and plenty of small teams do, because triaging them is nobody's favorite Tuesday — you just got a buffer between a compromised release and your production bundle.

What actually happened

Per the GitHub Changelog on July 14, 2026, the default cooldown applies across all supported ecosystems on github.com, with rollout to GitHub Enterprise Server 3.23. The mechanics:

• A new version isn't considered for a version update until three days after release
• Security updates are exempt — those still open immediately, so critical fixes are never held back
• You can change the window or opt out entirely with the cooldown option in .github/dependabot.yml

GitHub's stated rationale is the honest one: three days gives the community time to notice that a release is compromised or broken before it gets merged into your project automatically.

The distinction between version updates and security updates is the whole design. A cooldown that delayed security patches would be a downgrade. A cooldown that only delays "bumped a minor version on a Thursday" costs you nothing and buys real coverage.

Why the Dependabot cooldown matters for your business

Look at how npm supply-chain attacks actually work. Someone phishes a maintainer, publishes a malicious patch version, and it propagates through automated dependency tooling. The window between publish and detection is usually measured in hours — the community finds it, the registry pulls it, GitHub advisories light up. Every one of those attacks is defeated by not being first.

Three days is a boring, unglamorous control that beats most of that class of attack for free. It pairs with the other supply-chain defaults that shifted this year: npm 12 blocking install scripts and PyPI rejecting new files after 14 days. The ecosystem is converging on the same idea — automation is fine, but instant automation is where you get robbed.

Two things to actually do. First, check whether you already set cooldown in .github/dependabot.yml — if you configured a value previously, yours wins, and it may be shorter than three days. Second, resist the urge to opt out. The only real argument against it is wanting the latest version instantly, and there is no business on earth that needs a minor version bump three days sooner than it needs to not ship malware.

One gap worth naming: this covers what Dependabot opens as a PR. It does not cover a developer running npm install some-package@latest on their laptop and committing the lockfile. If you want the same buffer at the install layer, that's a separate control — npm's minimum-release-age and pnpm's minimumReleaseAge do it, and you should set them to match so the two layers don't disagree.

Sources: GitHub Changelog, Dependabot options reference.