Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

GitHub Dependabot adds a 3-day cooldown for version updates

Security Tool/Service
First reported
Last updated
Happening score
H score 11
1 unique sources, 1 articles

Summary

Hide ▲

GitHub Dependabot now waits at least three days after a release before opening a pull request, reducing the chance that a poisoned package version is quickly adopted into downstream builds. Security updates still flow immediately, so the control narrows exposure without slowing urgent patch adoption. The change adds a time-based safeguard against fast-moving supply chain attacks while preserving normal dependency maintenance.

Related Happenings

GitHub Dependabot and PyPI add time-based supply-chain defenses

Security Tool/Service
H score11 First: 26.07.2026 17:13 Last: 26.07.2026 17:13 Sources 1

How related: GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request.

About this happening: GitHub Dependabot and PyPI added time-based controls that slow malicious package adoption and restrict late release tampering across the software supply chain. Dependabo...

Open Happening

GitHub actions/checkout blocks fork pull request checkouts by default in privileged workflows

Security Tool/Service
H score11 First: 23.06.2026 17:22 Last: 23.06.2026 17:22 Sources 1

About this happening: GitHub's actions/checkout now refuses common pwn request patterns by default, cutting the risk of attacker-controlled code execution in privileged GitHub Actions workf...

Open Happening

Npm v12 default-blocks install scripts, Git dependencies, and remote URLs

Security Tool/Service
H score11 First: 12.06.2026 16:00 Last: 12.06.2026 16:00 Sources 1

About this happening: GitHub announced npm v12 with default-blocking install scripts, Git dependencies, and remote URLs, shifting package installation to explicit opt-in and reducing supp...

Open Happening

Miasma supply-chain malware activity

Malware Activity
H score34 First: 10.06.2026 23:27 Last: 10.06.2026 23:27 Sources 1

About this happening: The Miasma malware activity is enabling supply-chain compromise by stealing build environment and cloud credentials, then using them to poison legitimate packages...

Open Happening

GitHub npm v12 hardens install-time dependency execution and source resolution

Security Tool/Service
H score11 First: 10.06.2026 22:41 Last: 10.06.2026 22:41 Sources 1

About this happening: GitHub is tightening npm v12 next month by blocking automatic dependency install scripts and non-registry sources, reducing supply-chain attack paths triggered by npm in...

Open Happening

Timeline

  1. 27.07.2026 11:01 2 articles · 3h ago

    GitHub adds a 3-day cooldown for Dependabot version updates

    Initial Disclosure

    GitHub added a default three-day cooldown in Dependabot so version-update pull requests wait at least three days after a release is published before opening, while security updates still go out immediately. The cooldown remains configurable in dependabot.yml, and GitHub says the change is intended to reduce the chance that poisoned package releases are quickly adopted downstream without slowing urgent patch adoption.

    Show sources
    Open in new tab