Dependabot adds three-day cooldown before version updates
TL;DR
Dependabot now defaults to a three-day cooldown that delays version update pull requests.
What changed
Dependabot now applies a default three day cooldown before issuing version update pull requests. Developers and vibe builders who maintain repositories will see suggested changes arrive after this waiting period instead of right away. Basic users managing routine dependency tasks encounter the adjusted schedule in their projects.
Why it matters
The pause gives maintainers and security researchers time to address findings in a release before developers bring it into their code. In the specific use case of supply chain security for open source dependencies the three day window creates a concrete buffer against early adoption risks. It differs from faster notification styles in other dependency management setups.
What to watch for
Compare the new timing against manual dependency monitoring approaches to observe the difference in update speed. Developers should verify the setting by inspecting the dependabot.yml file in their repository after the next release cycle.
Who this matters for
- Vibe Builders: Update dependabot.yml to adjust the three-day cooldown if your app requires immediate patch releases.
Harsh’s take
Default delay settings in supply chain tools are a practical defense against zero-day package compromises. Waiting three days trades immediate version parity for security verification, stopping maligned releases before they hit your repository. Teams shipping fast must decide whether to keep this default or override it in dependabot.yml for low-risk internal packages. Establish clear guidelines on which dependencies bypass the buffer to avoid blocking critical bug fixes.
by Harsh Desai
More AI news
- FeatureHermes-agent enables smart approvals by default and adds user-defined deny rules
Hermes-agent now defaults to smart LLM approvals for flagged commands and evaluates each independently. It adds user-defined deny rules that block commands even in yolo mode with explanatory feedback via /deny.
- FeatureHermes-agent reduces first-token latency by 80% across platforms
Hermes-agent cuts cold-start initialization from 4.3s to 0.9s across CLI, gateway, TUI, and desktop. Live reasoning streams by default with per-token response rendering.
- FeatureCodex CLI stabilizes multi-agent V2 with sub-agent model controls
Codex CLI stabilizes the multi-agent V2 experience with configurable sub-agent models, adjustable reasoning levels, concurrency controls, restored roles, and improved navigation.