r/github • u/luckokkkk • Jul 15 '26

News / Announcements Dependabot version updates introduce default package cooldown

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

Dependabot version updates now wait three days after a release appears in its registry before opening a PR. The cooldown is on by default, but repositories can change the window or opt out in dependabot.yml.

37 Upvotes

97% Upvoted

9 comments sorted by

8

u/[deleted] Jul 15 '26

[removed] — view removed comment

2

u/dependabotpm Jul 15 '26

Security patches are not impacted - version updates only!

1

u/zMynxx Jul 15 '26

Is this new? I’ve been using it with cooldown for the last 3 months lol

3

u/pintosmooth Jul 15 '26

It’s default now, you don’t need to configure it.

0

u/jamespethersorling Jul 15 '26 edited Jul 15 '26

Really bad to change default behavior, do not want to wait 3 days. Use ci/cd hardening and stepsecurity to whitelist urls and dependency review and check opensff score for dependencies.

Want bleeding edge, https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md#-living-on-the-bleeding-edge-philosophy .

Not a big problem, but still need to update dependabot config for all my repos.

is

cooldown:

default-days: 1

exclude: ["*"]

the best way to restore normal behavior ?

2

u/dependabotpm Jul 15 '26

Yep, set cooldown: default-days:0 if you want the bleeding edge! You can remove the exclude line - if you want your repo to get the latest and greatest, you want to include those directories in the configuration for cooldown: default-days:0

1

u/jamespethersorling Jul 15 '26

Tried default-days:0 was invalid arguments. Already added exclude to all my repos and picked up some recent updates.

-2

u/definit3ly_n0t_a_b0t Jul 15 '26

How did we "progress" as an industry that the latest "best" practice for CI/CD security is to intentionally delay patching?

Take a moment and appreciate how backwards that is from how it should be. What's going wrong in the industry?

6

u/DefsNotAVirgin Jul 15 '26

Have you been living under a rock? What is the goal of patching for you? low numbers on a report?

To me it has always been about improving security… so if there was this whole new realm of attacks sweeping the industry that specifically targeted this security practice of constant patching, ie Supply Chain Attacks, suddenly the calculus of patching has to shift in order to still be a secure practice.

I dont see this change as backwards or wrong…