Wire · technology
GitHub Adds Three-Day Dependabot Cooldown to Block Supply Chain Attacks
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 27 July 2026 · Fusion42 review
GitHub has introduced a three-day default cooldown for Dependabot version updates to delay automated dependency pulls and block malicious packages before they spread through build pipelines. The feature responds to supply chain attacks where trojanized packages are detected and removed within hours, but fast enough to compromise systems before human review.
This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.
◆ ◆ The Wire takeaway
If you're selling software security, vulnerability scanning, or SCA tooling to enterprise teams, your customers just got a built-in competitive threat. GitHub is now doing your job for free—at least for the low-hanging malicious packages. The opening: teams still need to manage the backdoors GitHub's cooldown doesn't catch, and they need visibility into the three-day window itself.
◆ Related on Wire
◆ Topics