GitHub introduced a 3-day cooldown on Dependabot non-security version update pull requests, providing vulnerability scanners a detection window to catch poisoned packages before automated merging.

Key Takeaways

  • ✓Cooldown applies exclusively to non-security bumps; critical security CVE patches trigger immediately;
  • ✓Grants security scanners and community maintainers a 72-hour window to identify and revoke malicious releases;
  • ✓GitHub Security published detailed supply-chain guidelines explaining the necessity of update buffers.