Dependabot Now Waits Before Upgrading Your Deps

Your CI pipeline auto-merges Dependabot PRs the second they pass tests. Fast, clean, effortless — until a compromised package ships a malicious version and your build pulls it in before anyone can blink.

GitHub just added a default package cooldown to Dependabot version updates. It's a small changelog entry that closes one of the most under-discussed supply chain attack windows in modern development.

Why this matters

The attack pattern is simple and well-documented. An attacker compromises a maintainer account or registers a lookalike package. They publish a new version. Auto-merge pipelines worldwide scoop it up within minutes. Malicious code runs in production before the community notices, reports, or yanks the package.

This has happened repeatedly across npm, PyPI, and RubyGems. The faster your merge pipeline, the more exposed you are.

How it works

With the new default, Dependabot no longer fires a PR the instant a new version appears on the registry. It waits through a cooldown window first. If the version gets yanked, reported, or replaced during that period, Dependabot skips it and moves on.

The cooldown applies to version updates — the scheduled bump PRs. Security advisories still trigger immediately, which is the right call: if CVE data says "patch now," a delay would be counterproductive.

Where this helps

• npm ecosystems where account takeovers and typosquatting are constant threats
• PyPI packages where anyone can register names similar to popular libraries
• Docker base image updates where a compromised tag ships into every container you build
• Any pipeline with auto-merge enabled — the faster the merge, the bigger the risk reduction

Watch out

The cooldown adds latency to routine upgrades. If you've built tooling that expects same-day version bumps, adjust your expectations and your dashboards.

The default window might not match your risk tolerance. High-security environments may want a longer wait. Internal packages with controlled publishing pipelines may not need the delay at all — check whether you can override per ecosystem in your dependabot.yml.

Also, this only protects version updates. If you've wired Dependabot security updates to auto-merge, those still fire immediately. That's worth a separate conversation about whether instant merge is wise even for CVEs.

Try it yourself

Check which of your open Dependabot PRs are queued for auto-merge:

gh pr list --search "author:app/dependabot is:open" \
  --json number,title,autoMergeState \
  --jq '.[] | "#\(.number) [\(.autoMergeState // "disabled")] \(.title)"'

TL;DR

• What changed: Dependabot version updates now have a default cooldown before creating PRs for brand-new releases
• Why it matters: Breaks the window where auto-merge pipelines ingest freshly-published malicious packages
• Try today: Audit your auto-merge settings on Dependabot PRs, especially across npm and PyPI ecosystems