GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
Summary: GitHub added a Dependabot cooldown that waits at least three days after a release is published before opening a pull request, with the default applying only to version updates while security updates continue immediately. GitHub said three days pushes past the window where most poisoned-package attacks live without holding dependencies back longer than necessary, and noted similar cooldown controls have appeared across VS Code, Ruby, Bun, npm, pnpm, and Yarn as PyPI plans to block new files on a release after 14 days.
Bottom line: GitHub itself says the cooldown does little against backdoors planted and left dormant, maintainer sabotage, or a compromised build system - so the short-lived trojanized package it targets is only one of the supply chain patterns your dependency pipeline has to survive.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026