GitHub adds 3‑day cooldown to Dependabot updates to blunt supply‑chain attacks
GitHub now imposes a default three‑day wait before Dependabot opens version‑update pull requests, giving maintainers and security scanners time to flag malicious releases. The change follows recent npm supply‑chain attacks where poisoned packages spread within hours, and aims to cut the window for automatic infection.