GitHub gives Dependabot a three-day default cooldown to outlast poisoned-package windows
The Hacker News·medium signal
Reported July 27, 2026, Dependabot now delays version-update pull requests by three days by default, on the reasoning that most malicious package versions are published and pulled inside a short window — the cooldown pushes automated adoption past it. Security updates are exempt and still fire immediately, and the delay is tunable in dependabot.yml. This is a defensive posture worth copying for any agent that auto-merges dependency bumps: the mitigation is latency, not detection.