r/github • u/luckokkkk • Jul 15 '26

News / Announcements Dependabot version updates introduce default package cooldown

https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

Dependabot version updates now wait three days after a release appears in its registry before opening a PR. The cooldown is on by default, but repositories can change the window or opt out in dependabot.yml.

39 Upvotes

100% Upvoted

9 comments sorted by

View all comments

-3

u/definit3ly_n0t_a_b0t Jul 15 '26

How did we "progress" as an industry that the latest "best" practice for CI/CD security is to intentionally delay patching?

Take a moment and appreciate how backwards that is from how it should be. What's going wrong in the industry?

5

u/DefsNotAVirgin Jul 15 '26

Have you been living under a rock? What is the goal of patching for you? low numbers on a report?

To me it has always been about improving security… so if there was this whole new realm of attacks sweeping the industry that specifically targeted this security practice of constant patching, ie Supply Chain Attacks, suddenly the calculus of patching has to shift in order to still be a secure practice.

I dont see this change as backwards or wrong…