GitHub adds three-day Dependabot cooldown default
🔒 GitHub introduced a three-day cooldown in Dependabot that delays version-update pull requests for at least 72 hours after a release by default, while security updates continue to be issued immediately. The cooldown is configurable via dependabot.yml, letting teams set a different interval to suit their workflows. GitHub framed the change as a mitigation against short-lived poisoned package releases that spread quickly before removal, and recommended it be used alongside other defenses such as lockfiles and scoped tokens.
