Dependabot Gets 3-Day Cooldown to Block Package Poisoning

As of this week, Dependabot waits three days before pulling a new package release into your project. GitHub made that the default. PyPI pushed a parallel time-based control on the same day. Neither announcement was loud. Both matter more than the coverage suggests.

What changed and why it took this long

The attack pattern these close is simple and well-understood: bad actor publishes a poisoned release, automated tooling merges it within the hour, incident follows. It’s not a sophisticated technique. The reason it kept working is that Dependabot’s default has always been fast — open the PR, let CI run, auto-merge if green. That’s also what makes it useful. Until it isn’t.

The new default adds a three-day hold. GitHub confirmed the cooldown parameter in dependabot.yml controls the behavior, so you can extend it or configure per-package exceptions. The floor is three days; the ceiling is whatever you decide. PyPI’s mechanism works at the index level — it doesn’t require any configuration on your end, it just adds friction on the publisher side before packages propagate widely.

Three days isn’t a complete defense. A patient adversary sits on a poisoned version for a week and waits you out. But that’s not who’s attacking most of the organizations getting hit by supply chain incidents right now. Most of the actual damage comes from campaigns that depend on fast propagation — the window between “malicious release published” and “PR merged” being measured in hours. Closing that window matters.

What to actually do

Pull up your dependabot.yml now, not at the end of the sprint:

1. Set cooldown explicitly. If your config predates this release, you don’t know what you’re actually running. Check it. Three days is now the default, but that only applies if Dependabot’s default took effect — older configs may have explicit faster settings that override it.
2. Use per-package exceptions, not a global override. If you have a legitimate reason to pull some packages faster — internal releases, security patches from vendors you trust — scope that exception precisely. Don’t lower the global cooldown across your entire dependency tree to accommodate one edge case.
3. Fix auto-merge separately. The cooldown creates a detection window. Auto-merging Dependabot PRs without a human review step is a separate problem that the cooldown doesn’t solve. If you’re doing that, the three-day hold just means the malicious package waits three days before getting merged automatically. That’s still a loss.

Patch the dependabot.yml first. The PyPI index control is passive — it works without configuration — but your pipeline settings determine the actual risk surface on your side.

The pattern

This is three moves in the same direction in about a month. npm disabled install scripts by default — the path from package install to arbitrary execution at install time got meaningfully harder. Socket found fake payment-processor SDKs on PyPI and npm last month impersonating Paysafe and Skrill. GitHub Actions and Packagist vectors were actively exploited last week.

The registries are making conservative behavior the default because the alternative — expecting teams to manually vet every dependency update — stopped being realistic years ago. Time delays don’t make the problem go away. They change the economics of the attack, which is a different and more honest goal.

Configure accordingly. The three days you spend not watching a Dependabot PR are now working for you.