GitHub Blog
1. The case for a cooldown: Why Dependabot now waits before issuing version updates
这篇来自 GitHub 博客的文章详细介绍了 Dependabot 中一项重要的安全增强功能，直接针对通过恶意 npm 包进行的供应链攻击。冷却机制是一项基于数据的实用改进。 (score: 0.90)
Dependabot now waits at least three days after a release before opening a pull request to mitigate supply chain attacks where malicious versions are published and quickly pulled. This cooldown is on by default and configurable. The change is based on data showing many npm malware advisories are caught within hours, and a cooldown helps bypass that window. It is part of defense in depth, not a standalone solution.
- Attackers phished an npm maintainer and published malicious packages like chalk and debug.
- Automated update tools can open pull requests for malicious versions within hours.
- Dependabot now waits at least three days before opening version update pull requests.
- The cooldown gives time for detection and removal by security researchers and scanners.
- GitHub Advisory Database shows over 6,500 npm malware advisories in the year ending May 2026.
- Three days balances safety and timeliness; users can configure longer or shorter windows.
- A cooldown is one layer of defense; other measures like lockfiles and install script restrictions are recommended.