GitHub Dependabot adds three-day cooldown

GitHub's Dependabot now waits at least three days after a release before opening a version update pull request. The cooldown, configurable in dependabot.yml, aims to block malicious packages that are published and caught within hours. Security updates are still pushed immediately.