SecurityGitHub Blogabout 2 hours ago
Dependabot adds three-day cooldown for version updates
5 min read
Dependabot now waits at least three days after a release before opening a pull request. The cooldown targets supply chain attacks where malicious versions are published, spread, and caught within hours. The default delay pushes past that window. The cooldown configuration option in dependabot.yml still controls the behavior.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
