The default cooldown period for Dependabot version updates is now 3 days.
This page has been translated by machine translation. View original
Dependabot is a GitHub service that analyzes package dependencies and creates pull requests to fix vulnerabilities and update versions.
Given the current state of software supply chains, package management ecosystems are increasingly adopting quarantine period mechanisms that prevent the installation of packages that have not been available for a certain period of time, in order to avoid installing compromised packages. In fact, GitHub also released this feature (cooldown) in July 2025.
Starting July 14, 2026, the default cooldown period became 3 days.
On the other hand, security updates that fix vulnerabilities are still created immediately as before.
In other words, it works appropriately even without the Dependabot configurator being especially conscious of it.
This article verifies how the version Dependabot updates to changes depending on whether the cooldown setting is present or absent, targeting @aws-sdk/client-s3.
Changes to the Default Cooldown Period for Version Updates in the July 2026 Update
The cooldown feature was not added this time.
GitHub announced in the July 1, 2025 Changelog that the cooldown feature for Dependabot version updates became Generally Available.
At that time, it was a feature where users explicitly set the minimum number of days elapsed for a package by adding cooldown to .github/dependabot.yml.
What changed in the July 2026 update is the behavior when no waiting days are specified under cooldown in .github/dependabot.yml.
| Item | Before Change | After Change |
|---|---|---|
cooldown setting |
Available | Available |
Default candidate version for cooldown update |
Latest version | Latest version that has been available for 3 or more days |
In other words,
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
when written this way, the current behavior is the same as explicitly specifying default-days: 3 as follows.
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
cooldown:
default-days: 3
Tried It Out
Targeting @aws-sdk/client-s3, which is updated several times a week, we verify which version Dependabot will update to by specifying 3.1090.0 (which has been available for about a week) in package.json and running Dependabot.
{
"name": "dependabot-cooldown-aws-sdk-sample",
"version": "1.0.0",
"private": true,
"dependencies": {
"@aws-sdk/client-s3": "3.1090.0"
}
}
Using the same package.json, we compare by only changing the cooldown setting in the Dependabot configuration (.github/dependabot.yml).
| Case | cooldown Setting |
Expected Update Target |
|---|---|---|
| Case 1 | Omit cooldown section |
Latest version among those published 3 or more days ago |
| Case 2 | default-days: 0 |
Latest version published at the time of execution |
Recent Release Status
The recent release status of @aws-sdk/client-s3 is as follows.
$ npm view @aws-sdk/client-s3 time --json | tail -n 6
...
"3.1090.0": "2026-07-17T18:52:52.080Z",
"3.1091.0": "2026-07-20T18:48:14.180Z",
"3.1092.0": "2026-07-21T18:48:40.603Z",
"3.1093.0": "2026-07-22T18:47:09.729Z",
"3.1094.0": "2026-07-23T18:48:25.707Z"
}
Case 1: Omitting cooldown
This is the case to confirm the default behavior this time. The cooldown section is not written in dependabot.yml.
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
When run on the night of July 24, 2026, Dependabot created a PR to update from 3.1090.0 to 3.1091.0, which was the latest version among those published 3 or more days ago.
$ gh pr diff 1 --repo quiver/dependabot-cooldown | grep '@aws-sdk/client-s3'
- "@aws-sdk/client-s3": "3.1090.0"
+ "@aws-sdk/client-s3": "3.1091.0"
Case 2: Specifying default-days: 0
This is the case to disable cooldown for comparison.
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
cooldown:
default-days: 0
The expected result is that the latest version published at the time of execution is proposed in a PR, regardless of how many days have passed since publication.
When Dependabot was run after changing the settings, a PR was created to update from 3.1090.0 to the latest version at the time of verification, 3.1094.0.
$ gh pr diff 2 --repo quiver/dependabot-cooldown | grep '@aws-sdk/client-s3'
- "@aws-sdk/client-s3": "3.1090.0"
+ "@aws-sdk/client-s3": "3.1094.0"
Summary
As one defense against software supply chain threats, the cooldown feature has been widely adopted, with various approaches including server-side solutions like Dependabot, tool-level solutions like npm and uv, and proxies like Takumi Guard.
With the July 2026 Dependabot change, security updates are still handled immediately, while version updates have had their cooldown changed from 0 days to 3 days, making it easier to mitigate attacks where packages are taken down shortly after publication, even with default parameters.
As stated in the GitHub official blog's "Defense in depth", please consider the following measures in addition to cooldown and defend in multiple layers.
- Locking dependencies with lock files
- Disabling install scripts in CI where possible
- Limiting permissions of tokens used in build pipelines
- Reviewing update PRs before merging
Reference Links
- Dependabot supports configuration of a minimum package age · GitHub Changelog
- Dependabot version updates introduce default package cooldown · GitHub Changelog
- Version updates will wait out a cooldown by default · dependabot-core Discussion #15368
- The case for a cooldown: Why Dependabot now waits before issuing version updates
- Dependabot options reference - cooldown
- @aws-sdk/client-s3 - npm
- Verification repository quiver/dependabot-cooldown
