GitHub Adds a Default Delay Before Package Updates in Dependabot

GitHub has announced a change to how Dependabot version updates work: package updates are now subject to a default waiting period — a so-called cooldown.

The essence of the change is that Dependabot no longer proposes moving to a new version of a dependency immediately after it is published. Instead, the system waits for some time before creating the corresponding pull request.

This approach is meant to reduce the risks associated with updating to freshly released package versions that have not yet been battle-tested by the broader developer community.

The news of the change sparked considerable interest on Hacker News, where the post gathered 110 points and 68 comments.

Dependabot is a GitHub service that automatically tracks a project's dependencies and proposes updates for them, helping developers address vulnerabilities promptly and keep their code up to date.

Source: Hacker News