**GitHub Introduces Three-Day Cooldown for Dependabot Version Updates**

GitHub has implemented a default 72-hour delay for Dependabot version updates, requiring the tool to wait three days after a dependency release before opening a pull request for routine bumps, though security updates remain immediate; this change addresses software supply-chain attacks where malicious actors publish poisoned package versions and rely on automated update tools to propagate them before detection, as exemplified by a September 2025 npm incident in which trojanized versions of popular packages like chalk were removed within two hours but could have already triggered automated pull requests. Separately, PyPI has introduced a time-based control blocking new file uploads to releases older than 14 days to prevent attackers from poisoning stable releases if project tokens are compromised. Repository maintainers can adjust Dependabot's cooldown via the `cooldown` option in `dependabot.yml`, and GitHub recommends combining this with lockfile pinning, disabling install scripts in CI, scoping build-pipeline tokens, and reviewing dependency updates before merging.

This isn't a security patch. It's a scheduling protocol. GitHub and PyPI just publicly admitted that software supply chain attacks are not chaotic events—they are managed operations with a predictable lifecycle. Look at the 72-hour cooldown. Why seventy-two hours specifically? In the intelligence and cyber operations world, that three-day window matches the standard burn rate for a zero-day or a weaponized dependency. By forcing Dependabot to wait, they aren't simply blocking random attackers—they are normalizing a specific exploit window. The PyPI policy is the real dead drop. Blocking uploads to releases older than 14 days, while explicitly stating they were not aware of abuse, is the loudest tell in the document. If there was no abuse, why build the wall? You only build a wall where patrols have seen movement. They know exactly what attacks were running against old releases. They just can't tell you who was running them. The policy is a retroactive cover for operations already in play.

Follow the money behind the timing. The "chalk" and "debug" npm incident wasn't a warning to open source users—it was a proof of concept for a global asset management system. The prompt removal in "about two hours" wasn't reactive heroism. It was a demonstration of centralized kill-switch authority over a globally distributed registry. They patched it fast so they could cite it as a pretext for the very controls they had already drafted behind closed doors. The "defense layers" GitHub lists—lockfile pinning, scoping tokens, disabling scripts—are not just best practices. They are the architecture of a trusted workforce. Every open source developer is now a low-level asset who must submit to a corporate security tempo dictated by the platforms. This isn't the wild west anymore. It's a regulated enterprise zone. You just didn't get the memo because you weren't at the table when the capture happened.

This is about the fundamental architecture of permission for digital creation. If a code package cannot be updated until a central platform says so, you no longer own your infrastructure. You lease it from a platform with direct government and intelligence liaisons. Ask the hard question: if they were truly concerned about integrity, why didn't they mandate strict hardware signing keys instead of a timer? Because a timer is a police schedule. It provides a guaranteed SLA for oversight—a window for an authorized entity to review, approve, or seed the dependency tree before the product teams can see it. The only people who benefit from a known, enforced delay are the people who know exactly when the clock starts and ends. Do the research on the threat intelligence contracts signed in 2023 and 2024. The narrative you are being fed—"we are stopping hackers"—is the cover story for standardizing the surveillance, quarantine, and control architecture of the entire global software supply chain. The real question isn't who is hacking the packages. The real question is who is setting the schedule.

GitHub and PyPI Introduce Time-Based Defenses to Thwart Supply Chain Attacks

GitHub's Dependabot and PyPI have implemented new time-based security measures to reduce the risk of developers automatically adopting malicious packages in software supply chains. Specifically, GitHub's Dependabot now enforces a default three-day cooldown before opening pull requests for non-security dependency updates, while PyPI will reject uploads of new files to releases older than 14 days. These changes follow a series of high-profile package-ecosystem attacks, including the chalk and debug incidents, the "s1ngularity" operation, the Shai-Hulud campaign, and GhostAction, as well as a September 2025 npm attack where phished maintainer credentials led to poisoned versions of popular packages—affecting over 2 billion weekly downloads—that rewrote cryptocurrency wallet addresses in browser apps before being removed after two hours. Notably, projects can customize the waiting period through the cooldown option in dependabot.yml, offering flexibility beyond the default three-day window.

The Digital Quarantine Strategy

Notice the timing. Three days. Fourteen days. These aren't arbitrary numbers pulled from thin air — they're carefully calibrated windows designed to give the real gatekeepers time to scrub the record. I've watched this pattern before. When you control the infrastructure AND the response time, you control what developers ever get to see. The convenient narrative is "protecting from malicious packages." The uncomfortable truth is that these delays create an official memory hole — a quiet window where problematic code can be flagged, removed, and never reach the public audit trail. Ask yourself: why now? After decades of supply chain attacks, suddenly GitHub and PyPI coordinate on precisely timed delays? Look at the list of campaigns they cite: s1ngularity, Shai-Hulud, GhostAction. Notice how many of those names sound like intelligence operations, not script kiddies. That's the first clue that this isn't about security — it's about perception management.

The Two-Hour Anomaly and the Policy That Rewrites It

Go back to the September incident. They admit poisoned packages lived for "about two hours" before removal. Two hours. Hundreds of millions of downloads across two billion weekly pulls. Think about that. If they can remove that fast, why do developers now need to wait seventy-two hours for routine updates? The math doesn't work unless you understand the actual function of these delays. What gets lost in those three days? What never gets the pull request opened? The real target isn't the flashy cryptocurrency wallet heist — that's the distraction. The real target is the quiet, boring dependencies nobody audits. The ones that sit for years. The ones where a single changed line redirects data, modifies behavior, or phones home. Those get caught in the three-day net not because they're dangerous, but because someone upstream flagged them. Follow the control surface. The ability to delay is the ability to censor.

The Paper Trail They Accidentally Left

I want you to do something. Open PyPI's actual policy language. Look at who sits on their security advisory boards. Cross-reference with GitHub's parent company. Now look at the foundation charters backing both. I've been tracking this architecture for years — it's the same names, the same interlocking directorates, the same grant-funded "security researchers" who just happen to publish papers recommending exactly these delays six months before the policy appears. There are no coincidences. The "chalk and debug" attack was the pretext. The "about two hours" figure is the tell. They had the capability for instantaneous response. They chose delays instead. That choice wasn't technical — it was political. The question you need to sit with isn't "are these delays effective?" It's "who benefits from slowing down the distribution of open-source code?" The answer is already in the documents you haven't been told to read yet.