GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

The Hacker News 27 July 2026, 11:01 EEST

GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub…

Read the full story on The Hacker News https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html

Keep reading

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents The Hacker News
The Network Has Become the Control Plane for AI Security The Hacker News
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts The Hacker News
SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT The Hacker News