GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub has implemented a three-day cooldown period for Dependabot to mitigate the risk of malicious packages being rapidly adopted by downstream projects. This new feature aims to slow down the spread of poisoned packages, particularly those deployed quickly after a malicious update is published. It’s part of a broader effort to improve package security across various ecosystems.
GitHub has announced a new cooldown mechanism for Dependabot, a tool designed to automatically update project dependencies. This cooldown will delay Dependabot's pull requests for three days after a new version of a package is published. The goal is to reduce the impact of supply chain attacks where a malicious package is quickly adopted by numerous projects before it is removed from the package registry.
GitHub determined a three-day cooldown as the ideal balance, considering it prevents malicious packages from being rapidly deployed and adopted while avoiding unnecessary delays for legitimate updates. The tool will continue to alert developers and open pull requests for security updates immediately.
GitHub stressed that this cooldown is just one layer of defense, alongside other measures such as pinning dependencies with lockfiles, disabling install scripts in CI pipelines, and reviewing updates before merging. Similar cooldown controls have been implemented in other package ecosystems, including Visual Studio Code, Ruby, Bun, npm, pnpm, and Yarn, particularly in response to concerns about compromised publishing tokens and workflows on the Python Package Index (PyPI).