Dependabot adds 3‑day cooldown to curb supply‑chain attacks
Dependabot now waits three days before opening version‑update PRs, giving security researchers and maintainers time to spot malicious releases that often appear and get pulled within hours. This reduces the risk of automated tools pulling compromised npm packages into codebases, addressing a growing supply‑chain attack vector.