🔒GitHub Adds Default 3-Day Cooldown for Dependabot Updates
Dependabot now waits three days before suggesting updates
TL;DR
GitHub has introduced a default cooldown period of three days for Dependabot version updates, aiming to catch malicious releases. This policy does not affect security updates and can be customized in the dependabot.yml file.
GitHub now enforces a default three-day cooldown on Dependabot's automatic dependency upgrades to reduce the risk of integrating compromised packages. This move comes after several widely used npm packages were briefly replaced with malicious versions, collectively downloaded over 2 billion times weekly before being removed. The cooldown policy helps security scanners identify threats earlier but does not replace other defenses like pinning dependencies and disabling install scripts.
Key Points
Default cooldown period is three days before Dependabot suggests new package versions
Cooldown does not apply to security updates, ensuring timely fixes for known vulnerabilities
Teams can customize the cooldown duration in their dependabot.yml configuration file
A Reddit user validated a three-day delay as effective against most malicious releases
Hacker News commenters debated potential long-term effectiveness of such cooldowns
Why It Matters
If you're using Dependabot to manage package updates, this change could save your project from integrating compromised dependencies. The default three-day wait gives security scanners more time to flag threats, but teams should still implement additional safeguards like dependency pinning and disabling install scripts.
Frequently Asked Questions
Why does this matter?
If you're using Dependabot to manage package updates, this change could save your project from integrating compromised dependencies. The default three-day wait gives security scanners more time to flag threats, but teams should still implement additional safeguards like dependency pinning and disabling install scripts.
What happened?
GitHub has introduced a default cooldown period of three days for Dependabot version updates, aiming to catch malicious releases. This policy does not affect security updates and can be customized in the dependabot.yml file.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 2,390 builders reading daily.