GitHub Dependabot Adds Cooldown Period: Waits at Least Three Days After New Release
Score
72内容涉及一个小型但具体的功能变更，对熟悉 Dependabot 的用户有一定信息增量。
源自官方博客引用，表述清晰准确，直接传达了变更要点。
对于所有使用 Dependabot 的开发者有直接操作指导意义，能预防潜在问题。
引用时间为2026年7月14日，是最新发布的功能变更，时效性极高。
Simon Willison 博客直接引用 GitHub 官方公告，信源权威可靠。
Base 80.5 × T2 Source weight ×0.9 = 72
Curation line 70Selected
Why selected
Moderate information gain but high practical value, with direct guidance for Dependabot users.
AI commentary
「This change may seem minor, but it effectively reduces 'last-minute' incidents caused by automated updates. For teams relying on Dependabot for automated updates with sensitivity to stability, this cooldown is essential to understand. I recommend checking your repository settings soon to ensure the new policy aligns with your release cadence.」
Quick overview
GitHub's automated dependency update tool, Dependabot, now waits at least three days after a new version appears in its registry before opening a version update pull request. This cooldown aims to reduce compatibility issues from immediate updates, giving developers time to assess stability. The change is effective by default for all repositories using Dependabot version updates.
- Dependabot introduces a 3-day cooldown after a new version is available before opening an update PR.
- The policy mitigates compatibility risks from premature updates.
- Applied by default to all version update scenarios in managed repositories.
Full text
Showing the source text; the full translation is being generated.
Dependabot now waits until a new release has been available on its registry for at least three days before opening a version update pull request. This cooldown is now the default and requires no configuration.
— GitHub Changeling, embracing dependency cooldowns
Tags: dependency-cooldowns, packaging, security, github
Related items
84
FeaturedHow to Evaluate LLMs Before Production: Lessons from GitHub
GitHub 实战分享：如何在生产前评估 LLM
This practical guide stands out because it comes from a real security scenario, not theoretical reasoning. Teams integrating LLMs into production, especially those working on security scanning and data-sensitive engineering, should definitely read it. I recommend designing evaluation sets around your own business data rather than blindly adopting public benchmarks.
84
FeaturedRuff v0.16.0 Released: Default Rules Jump from 59 to 413, CI Pipelines Need Attention
Ruff v0.16.0 发布：默认规则从59条激增至413条，CI工作流需关注
For Python developers, this is an unmissable update signal. The significant increase in Ruff's default rules means we can no longer ignore potential issues in our code, and AI fix tools can lower the upgrade cost. Notably, Astral (OpenAI) is deeply integrating AI coding capabilities with static analysis tools, which may become the norm in future engineering practices.
81
FeaturedOpenRouter Team AI Spend Controls Setup Tutorial
OpenRouter 团队 AI 支出控制设置教程
As AI API spending balloons, OpenRouter's official governance tutorial signals that platforms are taking enterprise cost management seriously. Rather than waiting for bill shock, teams should configure these guardrails early. This is especially valuable for platform engineers and finance owners overseeing AI usage.
81
FeaturedFireside Chat with Anthropic's Claude Code Team: How AI Coding Agents Reshape Software Development
Anthropic Claude Code 团队炉边谈话：AI 编码代理如何重塑软件开发
The value of this fireside chat lies not in repeating Claude Code's features, but in revealing how Anthropic internally redefines engineering processes—shifting from 'execution-heavy' to 'taste-heavy'. For anyone in an AI product team, Cat's point that 'product taste outweighs execution' is worth pondering. Thariq's subversion of the 'never rewrite' rule also reminds us that traditional software engineering principles are being rewritten by AI capabilities.
80
FeaturedGPU Management: Why Idle GPUs Are the New Grounded Aircraft
GPU管理：闲置GPU为何成为新的停飞飞机
This blog is worth reading because it elevates GPU resource management to an economic perspective, using the grounded aircraft analogy to visualize waste. Teams using Kubernetes for GPU clusters can immediately try the recommended tools. However, users in China should note the compatibility of some tools outside AWS/GCP environments.
80
FeaturedAn Opinionated Guide to Which AI to Use to Do Stuff
一份主观指南：如何选择AI来做事情
This blog post is Simon Willison's refined take on Ethan Mollick's guide, ideal for developers and power users struggling to choose between ChatGPT and Claude and their various agent modes. It cuts through the confusion of product naming and unintuitive platform differences, offering clarity that saves hours of trial and error.
80
FeaturedPyPI Implements 14-Day Upload Window to Prevent Supply Chain Poisoning
PyPI 实施14天上传期限以防止供应链投毒
This is a critical message for the Python ecosystem. If you maintain any PyPI project, check your release workflow immediately — the 14-day window means you can no longer patch or overwrite files on old releases; you must publish a new version. For security teams, this is a best practice in supply chain security worth emulating by other package managers.
80
FeaturedLobsters Community Successfully Migrates to SQLite: A Win for Single-Server Architecture
Lobsters 社区成功迁移至 SQLite：单服务器架构的胜利
This migration case is particularly noteworthy because it challenges the conventional wisdom that small sites must adopt distributed databases. Lobsters proves that in 2026, a single server with SQLite can handle an active community. For startup teams struggling with overcomplicated tech stacks, this is an excellent reference for cost reduction and efficiency improvement.