GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub has implemented a mandatory 3-day cooldown in Dependabot before version updates are applied automatically, whilst security patches are still issued immediately. The change aims to reduce the window for poisoned package attacks to propagate, balancing supply-chain safety against dependency freshness.

This Wire brief sits within Fusion42's coverage of Enterprise Software and Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.