Dependabot now waits three days before non-security version update pull…

GitHub has introduced a default three-day wait before Dependabot proposes a newly published dependency version. The delay applies to routine version updates; pull requests fixing known security vulnerabilities still open immediately. Projects can adjust the waiting period. GitHub's announcement explains the distinction.

The delay gives maintainers and scanners time to identify and remove a malicious release before an automated update proposes adopting it. It targets attacks discovered soon after publication. A dormant backdoor can outlast that waiting period, so the cooldown changes when routine updates arrive without establishing that an older release is safe.