GitHub, PyPI Add Time-Gated Supply Chain Defenses

GitHub and PyPI shipped independent time-based controls this week that address a gap in automated dependency pipelines. Neither change retroactively fixes what’s already in your lock file. Both close real attack windows going forward.

What changed

GitHub — Dependabot 72-hour cooldown. Dependabot now delays package update pull requests for 72 hours after a new version is published. The window is configurable. The premise is practical: security tooling often flags malicious packages within minutes of upload, but the gap between detection and takedown still lets automated pipelines pull and merge a bad package before anyone can react. Seventy-two hours is a buffer for that detection loop to complete before your pipeline acts on it. Source: BleepingComputer.

PyPI — 14-day release modification cutoff. PyPI is blocking maintainers from uploading new files to an existing release more than 14 days after the original publish date. This closes a release-poisoning path: an attacker with a compromised maintainer account could swap the tarball behind an already-trusted release version, letting malicious code inherit adoption the original version earned. PyPI’s own data showed legitimate uploads past the 14-day mark are rare — so the cutoff costs almost nothing for normal package maintenance and removes a meaningful attack surface.

What to actually do

These are platform controls — they activate without you changing anything — but they only help if your pipeline is set up to use them.

• Confirm Dependabot is enabled. The cooldown applies only where Dependabot is active. Check your GitHub org settings and verify coverage across every repository pulling from npm, PyPI, RubyGems, or other ecosystems.
• Review automerge + cooldown configuration. If your dependabot.yml sets the cooldown to zero, or you’ve configured automerge to fire immediately, you’ve bypassed the protection. Read your config before assuming you’re covered.
• Pin hashes in your lock file for pipelines that can’t wait 72 hours. CI/CD environments with strict latency requirements can achieve the same tamper-evident guarantee through hash pinning rather than time-gating. It’s not either/or.
• Inventory your transitive dependency exposure. Time-gating catches direct dependencies where Dependabot acts. Deeply nested transitive packages — especially anything not hash-pinned — remain outside these controls.

PyPI’s change is a publisher-side control. If you maintain packages on PyPI, note the 14-day window: any corrected wheels or sdists for an existing release must be uploaded within that period. If you only consume packages, no action required.

Priority call

For most organizations: medium-priority configuration review, no emergency. The configuration check matters — the cooldown doesn’t help if you’ve already set it to zero with automerge. The PyPI cutoff requires no action from package consumers.

Neither of these changes retroactively hardens what’s already in your current dependency tree. Your lock file and supply chain hygiene practices are still the primary control. These are useful additions, not a substitute for the work you already need to do.

Related coverage: npm install scripts disabled by default, StepSecurity dormant RubyGems account compromise, Attackers weaponizing GitHub Actions against cPanel hosts.

Source: GitHub, PyPI add time-based defenses against supply-chain attacks — BleepingComputer, July 26, 2026.