GitHub Adds 3-Day Dependabot Cooldown to Block Poisoned Package PRs

Mon, 27 Jul 2026 13:44:31 +0000

Engineer — Plan: Review all repos using Dependabot and explicitly configure the cooldown parameter in dependabot.yml; the 3-day default delays auto-PR creation for fresh packages, reducing poisoned-package exposure in automated update pipelines.
SOC/IR — Skip
Leader — Learn: Signals growing industry recognition of time-based supply chain defenses; useful context for maturing your software supply chain policy, though no immediate leadership action is required.

Dependabot on CuraSec