GitHub has introduced a mandatory three-day delay for automated Dependabot version updates to prevent developers from inadvertently installing malicious code published to the npm package registry.

Key Points

• GitHub’s Dependabot now waits 72 hours before opening pull requests for non-security version updates to allow time for malicious packages to be identified and removed.
• The policy change follows a September 2025 incident where compromised versions of popular packages like chalk and debug were automatically pushed to users within hours.
• Security updates remain unaffected by the delay, as these patches address known vulnerabilities that require immediate remediation.
• GitHub logged over 6,500 npm malware advisories in the year ending May 2026, averaging 18 new malicious packages discovered daily.
• Developers can customize the cooldown period in their dependabot.yml configuration files or disable it for trusted internal packages.

Why it Matters

This update provides a critical buffer against automated supply chain attacks that exploit the speed of continuous integration tools. While it does not protect against long-term sabotage or dormant backdoors, it effectively mitigates the risk of "fast-burn" malware that is typically caught by the community within hours of publication.