Version updates will wait out a cooldown by default

[robaiken]

Starting July 14, Dependabot will wait until a new release has been on its registry for at least 3 days before opening a version update PR. This will be the default and will need no configuration

New releases are a common entry point for supply chain attacks. A compromised or broken version can land in your dependency updates before maintainers and the community have caught it. A short delay gives that signal time to surface, so you are less likely to merge a bad release the moment it ships.

A few things to know:

• This will apply to version updates only. Security updates will still open immediately, so critical fixes are never delayed.
• You stay in control. Use the cooldown option in your dependabot.yml to set a different window, or set it to 0 to remove the cooldown entirely.

This rolls out for version updates across all supported ecosystems.