GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub introduced a default three-day cooldown for Dependabot version-update pull requests to reduce the window in which recently published, potentially poisoned packages can spread to downstream projects; security patches remain immediate and the cooldown is configurable. The article frames this as one defensive layer alongside measures such as lockfile pinning, disabling install scripts in CI, scoping pipeline tokens, and manual review, and notes similar time-based controls being adopted across package ecosystems and PyPI's plan to block file additions after 14 days.