The Reason for the Cooldown: Why Dependabot Waits Before Version Updates

In September 2025, an attacker hijacked an npm maintainer account and inserted malicious code into packages like chalk and debug, which have over 2 billion weekly downloads. The malicious version was removed in about 2 hours, but that was enough time for automated update tools to detect the new version and open PRs.

According to the GitHub Advisory Database, over 6,500 npm malicious package advisories were registered in the one-year period from May 2025 to May 2026, with an average of 18 new malicious packages added to the list per day. Compromise cases involving major packages such as Solana web3.js, Axios, and ua-parser-js all showed a pattern of being discovered and removed within hours.

In response, Dependabot has set a cooldown as the default, waiting at least 3 days after release before creating PRs for non-security version updates. Three days is a balance point that filters out most short-lived malicious versions while not unnecessarily delaying dependency updates. The period can be adjusted via the cooldown option in dependabot.yml.

However, cooldown is only effective against attacks that are quickly distributed and removed, and cannot address backdoors that lurk for extended periods or build system compromises. It should be used alongside multi-layered defenses such as pinning dependencies with lockfiles, disabling install scripts in CI, and scoping down build pipeline tokens.