Dependabot now waits three days before non-security version update pull…
Source
GitHub
Author
GitHubTop Viber
Date
Why it matters
If you rely on Dependabot, routine version bumps now arrive three days later by default — a deliberate trade of update latency for a window in which a compromised release can be found before it reaches your code.