Early adopters of Dependabot cooldown mostly chose a simple waiting period before dependency updates. The study found security concerns in 83 of 92 adoption events with known motivations. Among retained configurations using a general delay, 64.3% chose seven days. These are observations about adoption and settings, not measurements of attacks prevented.
GitHub's July 2026 announcement, covered in earlier reporting, distinguishes routine version updates from security fixes: its three-day default delays the former while security updates proceed immediately. The study's seven-day preference should therefore not be mistaken for the product default.
Key takeaways · AI-distilled
GitHub's Dependabot cooldown feature, made generally available in July 2025, delays automated dependency updates as a defense against supply-chain attacks that push malicious releases before maintainers can react.
Among adoption events with a known motivation, security concerns drove 83 of 92 cases, and security linter warnings specifically triggered 43 of 75 security-only adoptions.
Of 251 ecosystems within repositories that kept cooldown enabled, 97.2% set a general delay, and 64.3% of those chose a seven-day delay rather than a custom value.
Fine-grained per-update-type cooldown settings were used in under 10% of cases each, and the authors say most early adopters prefer simple default delays over granular configuration.
articleAgentLogs: A Dataset for Opening the Black Box of GitHub's Cloud AgentJonan Richards, Kosei Horikawa, Youmei Fan, Yutaro Kashiwa, Mairieli Wessel
articleNot All Agents Are Equal: Code Quality and Post-Merge Maintenance Across Five Autonomous Coding Agents in the WildObada Kraishan
articleA Few Pages of Markdown: Committed AI Configuration and Lower Quality Cost after Coding-Agent AdoptionYegor Denisov-Blanch, Shyam Agarwal, Pavel Azaletskiy, Hao He, Rylan Schaeffer, Brando Miranda, Bogdan Vasilescu, Sanmi Koyejo