Dependabot Cooldown: Why Waiting 3 Days is Smarter

Automatic dependency updates are a double-edged sword. The goal is to stay current, but the reality is that "newest" often means "unvetted." When a maintainer's credentials get phished—like in the September 2025 attack on packages like chalk and debug—malicious code can hit registries and trigger automated PRs within minutes. Two hours is a blink of an eye for a human, but it's plenty of time for a bot to inject a poisoned version into your build pipeline.

This is why Dependabot now defaults to a three-day cooldown for version updates.

Version Updates vs. Security Updates

It is important to distinguish between the two types of PRs Dependabot generates:

• Security updates: These target known vulnerabilities. When an advisory is published, Dependabot acts immediately. There is no cooldown here because waiting would leave you exposed to a known flaw.
• Version updates: These are general bumps to keep you current. This is where the cooldown applies. Since these aren't fixing a specific known bug, waiting a few days doesn't hurt your security—it actually enhances it.

The Math Behind the 3-Day Wait

Looking at the GitHub Advisory Database, the volume of malware is staggering. In the year ending May 2026, over 6,500 npm malware advisories were published—that's roughly 18 malicious packages every single day.

The pattern for these attacks is almost always the same: publish, spread, and get caught. Most poisoned versions of high-traffic packages (like axios or ua-parser-js) are identified and pulled within a few hours. By shifting the default to three days, you effectively dodge the "danger window" where most supply chain attacks live without falling significantly behind on features.

If the default doesn't fit your specific AI workflow or project needs, you can still tweak this in your dependabot.yml config. For most of us, though, taking a breath before updating is a cheap insurance policy against credential theft.