⚡ A poisoned package can land in a Dependabot update PR before registries remove it. GitHub is adding a 3-day cooldown for routine version updates, while security fixes will still move immediately. Why three days, and what the delay cannot stop: https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html

<p>⚡ A poisoned package can land in a Dependabot update PR before registries remove it.<br /> <br /> GitHub is adding a 3-day cooldown for routine version updates, while security fixes will still move immediately.<br /> <br /> Why three days, and what the delay cannot stop: <a href="https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html">thehackernews.com/2026/07/gi…</a></p> <img src="https://nitter.net/pic/media%2FHOOD9xKagAAHwCY.jpg" />