GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

Summary

GitHub has introduced a new three-day cooldown period for Dependabot alerts. This feature aims to prevent the automatic adoption of potentially poisoned packages by giving maintainers time to review newly published dependencies before Dependabot creates a pull request.

IFF Assessment

FRIEND

This is good news for defenders as it introduces a protective measure against malicious package adoption.

Defender Context

This change directly addresses the risk of supply chain attacks where malicious code is introduced into popular libraries. Defenders should be aware of this new default behavior and configure their Dependabot settings appropriately to maximize this protective cooldown period.

Read Full Story →