GitHub Dependabot now delays version update pull requests by three days to reduce supply chain risk

GitHub says Dependabot will now wait at least three days after a new package release appears in its registry before opening a version update pull request. The default cooldown applies across supported ecosystems on github.com, while security updates still open immediately and teams can adjust or disable the delay in dependabot.yml.

The change reflects growing concern that automated dependency updates can quickly spread compromised or broken packages before the ecosystem detects them. By adding a default delay, GitHub is shifting Dependabot toward a more cautious supply chain security posture while preserving urgency for critical fixes.