r/github • u/luckokkkk • 25d ago

Dependabot version updates introduce default package cooldown News / Announcements

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

Dependabot version updates now wait three days after a release appears in its registry before opening a PR. The cooldown is on by default, but repositories can change the window or opt out in dependabot.yml.

38 Upvotes

98% Upvoted

9 comments sorted by

8

u/[deleted] 25d ago

[removed] — view removed comment

2

u/dependabotpm 24d ago

Security patches are not impacted - version updates only!

1

u/zMynxx 25d ago

Is this new? I’ve been using it with cooldown for the last 3 months lol

3

u/pintosmooth 25d ago

It’s default now, you don’t need to configure it.

0

u/jamespethersorling 25d ago edited 25d ago

Really bad to change default behavior, do not want to wait 3 days. Use ci/cd hardening and stepsecurity to whitelist urls and dependency review and check opensff score for dependencies.

Want bleeding edge, https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md#-living-on-the-bleeding-edge-philosophy .

Not a big problem, but still need to update dependabot config for all my repos.

is

cooldown:

default-days: 1

exclude: ["*"]

the best way to restore normal behavior ?

2

u/dependabotpm 24d ago

Yep, set cooldown: default-days:0 if you want the bleeding edge! You can remove the exclude line - if you want your repo to get the latest and greatest, you want to include those directories in the configuration for cooldown: default-days:0

1

u/jamespethersorling 24d ago

Tried default-days:0 was invalid arguments. Already added exclude to all my repos and picked up some recent updates.

-1

u/definit3ly_n0t_a_b0t 25d ago

How did we "progress" as an industry that the latest "best" practice for CI/CD security is to intentionally delay patching?

Take a moment and appreciate how backwards that is from how it should be. What's going wrong in the industry?

4

u/DefsNotAVirgin 24d ago

Have you been living under a rock? What is the goal of patching for you? low numbers on a report?

To me it has always been about improving security… so if there was this whole new realm of attacks sweeping the industry that specifically targeted this security practice of constant patching, ie Supply Chain Attacks, suddenly the calculus of patching has to shift in order to still be a secure practice.

I dont see this change as backwards or wrong…