GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub has introduced a 3-day cooldown period for Dependabot to mitigate the risk of poisoned package adoption in software supply chains. This delay allows time to detect and block malicious versions of popular packages before they are automatically pulled into downstream projects. The measure complements other security practices like dependency pinning and token scoping, though it is ineffective against long-term threats such as dormant backdoors or compromised build systems.

AI-extracted · verify before operational use