Quoting GitHub Changeling
Summary
GitHub's Dependabot now defaults to a three-day cooldown before opening version update pull requests, requiring no configuration.
View Cached Full Text
Cached at: 07/15/26, 12:17 AM
Similar Articles
Dependabot version updates introduce default package cooldown
Dependabot now waits three days before opening version update PRs to reduce risk of supply chain attacks. Security updates remain immediate.
@github: Pull requests are easier to open than ever, but every review still takes human effort. Introducing pull request limits:…
GitHub introduces pull request limits, allowing maintainers to cap open PRs from contributors without write access, with a bypass list for trusted contributors.
@dabit3: Super interesting story that shows how the current state of @github is unable to protect open source maintainers from A…
A story detailing how AI bots overwhelmed a GitHub repository with spam comments and untested PRs after a $900 bounty was posted, forcing maintainers to implement workarounds like contributor whitelists and reputation bots, highlighting GitHub's lack of anti-bot mechanisms.
@danshipper: GitHub has a front-row seat to how code is changing now that everyone—and their army of agents—can ship code. In March …
GitHub COO Kyle Daigle discusses the surge in AI agent-created pull requests (17 million in March) and the projected 14 billion commits this year, emphasizing open-source maintainer control, usage-based pricing over per-seat licensing, and the collapsing developer/non-developer distinction as AI tools enable non-developers to build apps.
Cooldown Support for Ruby Bundler
Bundler 4.0.13 introduces a cooldown feature that blocks resolution to gems published less than N days ago, mitigating supply-chain attacks. It is opt-in and configurable per source, setting, or command-line flag.