GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request.
“The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project,” the Microsoft-owned subsidiary said.
According to GitHub, the three-day cooldown default only applies to version updates, which are designed to keep software dependencies up-to-date. Security updates will continue to be pushed right away, permitting Dependabot to issue an alert and open a pull request to move the project to the patched version.
With this update, the idea is to handle scenarios where a threat actor manages to push a poisoned version of a popular package, which then gets quickly pulled by downstream projects before that version is yanked from the registry. Although such trojanized packages are short-lived, the time period for which they remain accessible is enough to expand the blast radius of a supply chain attack.
GitHub said it arrived at three days as the default as it considers the duration to be in the goldilocks zone. “Three days as the default balances two goals: it pushes you past the window where most of these attacks live, and it doesn’t hold your dependencies back longer than necessary,” it added.
At the same time, the software development platform emphasized that the control should be just one layer of defense among several others, including pinning dependencies with lockfiles, disabling install scripts in CI, scoping the tokens in build pipelines, and reviewing updates before they merge.
“A cooldown is built for a specific pattern: a malicious version that ships, spreads, and gets caught quickly,” GitHub said. “It does little against attacks that play a longer game, including backdoors planted in releases and left dormant, maintainer sabotage, or a compromised build system.”
It’s worth noting similar cooldown controls have been announced across various package ecosystems over the past year, including Microsoft Visual Studio Code (VS Code), Ruby, Bun, npm, pnpm, and Yarn.
GitHub’s time-based defense comes as the maintainers of the Python Package Index (PyPI) announced plans to block maintainers from adding new files to a package release after 14 days have passed since its publication.
“The measure is intended to prevent attackers who compromise publishing tokens or workflows from poisoning old, trusted releases,” PyPI noted.
