---
title: "GitHub Dependabot Adds Cooldown Period: Waits at Least Three Days After New Release"
source: "Simon Willison 博客（Atom）"
source_tier: "t2"
url: "https://simonwillison.net/2026/Jul/14/github-changeling/#atom-everything"
permalink: "https://feed.astralor.com/items/itm_b82951733718dba0dbe840f7"
published: "2026-07-14T22:43:35.000Z"
score: 72
channel: "tech"
tags: ["Dependabot","GitHub","Dependency Management"]
---

# GitHub Dependabot Adds Cooldown Period: Waits at Least Three Days After New Release

## AI commentary

> This change may seem minor, but it effectively reduces 'last-minute' incidents caused by automated updates. For teams relying on Dependabot for automated updates with sensitivity to stability, this cooldown is essential to understand. I recommend checking your repository settings soon to ensure the new policy aligns with your release cadence.

## At a glance

GitHub's automated dependency update tool, Dependabot, now waits at least three days after a new version appears in its registry before opening a version update pull request. This cooldown aims to reduce compatibility issues from immediate updates, giving developers time to assess stability. The change is effective by default for all repositories using Dependabot version updates.

## Key points

- Dependabot introduces a 3-day cooldown after a new version is available before opening an update PR.
- The policy mitigates compatibility risks from premature updates.
- Applied by default to all version update scenarios in managed repositories.

## Full text

Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the …

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_b82951733718dba0dbe840f7