GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
Summary
GitHub has introduced a new three-day cooldown period for Dependabot alerts. This feature aims to prevent the automatic adoption of potentially poisoned packages by giving maintainers time to review newly published dependencies before Dependabot creates a pull request.
IFF Assessment
FRIEND
This is good news for defenders as it introduces a protective measure against malicious package adoption.
Defender Context
This change directly addresses the risk of supply chain attacks where malicious code is introduced into popular libraries. Defenders should be aware of this new default behavior and configure their Dependabot settings appropriately to maximize this protective cooldown period.