Wire · technology
GitHub implements version update delay so security issues can be caught
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 27 July 2026 · Fusion42 review
GitHub's Dependabot now enforces a three-day cooldown by default on version updates (excluding security patches), giving security researchers time to detect malware in newly released packages before widespread adoption. The change responds to supply-chain attacks where malicious versions have historically been caught and removed within hours.
This Wire brief sits within Fusion42's coverage of Enterprise Software and Cybersecurity, and 7 sources have reported it between 27 Jul 2026 and 31 Jul 2026.
◆ ◆ The Wire takeaway
If you distribute packages or tools via npm, PyPI, or similar registries, your window to catch and pull a poisoned release before mass infection just shrank from hours to minutes—and GitHub's default now assumes your users won't adopt your updates for three days. Reconsider your release frequency and testing pipeline; slow release cycles now protect you, but fast ones leave you exposed.
◆ Coverage
7 sources · first reported 27 Jul 2026 · latest 31 Jul 2026
◆ Related on Wire
◆ Topics