Dependabot version updates introduce default package cooldown
摘要
Dependabot 现在对版本更新默认等待新版本在注册表上可用至少 3 天后才打开版本更新拉取请求，此冷却期已为默认，无需额外配置。新版本是供应链攻击常见入口，短延时可让社区信号时间浮现，因此更少合并不良版本。安全更新仍立即打开。用户仍可通过.github / dependabot.yml 中的冷却选项设置不同窗口或完全禁用。此默认适用于所有支持生态系统，将在 GitHub Enterprise Server 3.23 生效。
荐读理由
在你的 .github/dependabot.yml 中把 cooldown 设置成你想要的窗口（或直接 opt out），就能给依赖更新增加 3 天默认缓冲，避免 GitHub 仓库版本更新前的供应链攻击风险
原文
Improvement
July 14, 2026 • 1 minute read
Dependabot version updates introduce default package cooldown
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.
New releases are a common entry point for supply chain attacks where a compromised or broken version can reach your dependency updates before maintainers and the community have caught it. A short delay gives that signal time to surface, so you are less likely to merge a bad release the moment it ships.
A few things to know:
The default applies only to version updates. Security updates still open immediately, so critical fixes are never delayed.
You stay in control. Use the
cooldownoption in your.github/dependabot.ymlto set a different window or opt out entirely.
This default applies to Dependabot version updates across all supported ecosystems on github.com and will take effect in GitHub Enterprise Server (GHES) 3.23.
Learn more in our docs about Dependabot cooldowns.
这条对你有帮助吗？