Version updates now have a 3 day cooldown by default

[robaiken]

Dependabot version updates now waits at least three days after a release is published before opening a version update pull request. This is the new default and requires no configuration.

Why we're doing this

The last year has made the risk hard to ignore. Attackers have repeatedly compromised maintainer accounts and pushed malicious versions of popular packages, and the surge in AI-discovered vulnerabilities has made the window between release published and problem found more dangerous than ever. In most of these incidents, the malicious version was caught and pulled within hours or days of publishing.

That's exactly the window the cooldown protects. If a bad release ships, three days gives maintainers, scanners, and the community time to catch it before Dependabot suggests it to you. Fresh isn't always better. Slightly aged is safer.

Security updates are not affected

The cooldown applies to version updates only. Security updates still open immediately, so critical fixes are never delayed.

You stay in control

Use the cooldown option in your .github/dependabot.yml to set a different window per ecosystem, or set it to 0 to remove it entirely.

This applies to Dependabot version updates across all supported ecosystems.

Full changelog: https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/

[pzygielo]

Dependabot version updates now waits at least three days after a release is published before opening a version update pull request. This is the new default and requires no configuration.
...
This applies to Dependabot version updates across all supported ecosystems.

Does it work on GitHub? For maven?

What does it mean release is published?

This https://github.com/hcoles/pitest/releases/tag/1.25.8

• was GitHub-release published just today (11 hrs ago),
• the artifacts in Central are Signature made Mon Jul 20 11:48:38 2026 CEST (so I suppose they didn't show up in Central much earlier, rather later)
• I have no cooldown configured in .github/dependabot.yml at all

Yet - the PR Bump org.pitest:pitest-maven from 1.25.7 to 1.25.8, (referencing GH RN) was just offered by [daily] scheduled job in my repository.

updated-dependencies:
- dependency-name: org.pitest:pitest-maven
  dependency-version: 1.25.8
  dependency-type: direct:production
  update-type: version-update:semver-patch

😕