- Dependabot now waits three days by default before opening pull requests for routine version updates, giving maintainers and scanners more time to detect malicious releases.
- PyPI blocks new files from being added to releases more than 14 days old, reducing the risk of attackers poisoning trusted package versions.
- GitHub's Dependabot applies a default three-day cooldown before opening a pull request for a routine version update.
- PyPI will no longer accept new files uploaded to a release once it’s more than 14 days old.
- A cooldown period buys back some of that lost time, allowing for detection of malicious versions before they land in a pull request.
- PyPI has said it isn’t aware of this technique being used in a real attack yet; the restriction is preventative.
- When the PyPI team checked how often projects legitimately publish new files to old releases, the number was small even in edge cases.
- GitHub had already announced changes to npm security last month, and this cooldown builds directly on that effort.
- Elapsed time now governs when an automated update reaches a pull request and how long a published release stays open to new files.
- GitHub still recommends pairing the cooldown with lockfiles for dependency pinning, tightly scoped access tokens, and turning off installation scripts that aren’t strictly needed in CI pipelines.
- In software supply chain security, the first few days after a release ships are often the most dangerous.
GitHub's Dependabot has introduced a three-day cooldown before opening pull requests for routine version updates, enhancing security by allowing maintainers and automated scanners to detect malicious releases. This change follows previous updates to npm security and aims to mitigate risks in software supply chain security.13911
The cooldown period is crucial as the first few days after a release are often the most dangerous. GitHub emphasizes that this measure gives maintainers and researchers a chance to catch and remove malicious versions before they are integrated into projects.56
In parallel, PyPI has implemented a new policy that blocks new files from being added to releases older than 14 days. This preventative measure aims to reduce the risk of attackers poisoning trusted package versions, although PyPI has stated it is not aware of any real attacks utilizing this technique yet.2478
Data from PyPI indicates that the frequency of legitimate updates to old releases is minimal, with only a tiny fraction of popular packages needing to add new files after two weeks. This suggests that the new policy will not significantly disrupt normal operations while enhancing security.
GitHub continues to recommend pairing the cooldown with other security practices, such as using lockfiles for dependency pinning and limiting access tokens, to further safeguard against potential vulnerabilities.
“Dependabot's new three-day cooldown allows maintainers and scanners more time to detect malicious releases, enhancing security. Meanwhile, PyPI's restriction on adding new files to older releases aims to prevent potential attacks, although the platform has not yet seen this technique used in real incidents.”
DevOps.com
