↪ Replying to @github.com
This actually makes a lot of sense. With dependencies, being fast isn’t always a good thing. Giving new releases a few days to get checked could help catch a malicious package before it spreads to thousands of projects. 🔐
Dependabot now waits three days before non-security version update pull requests, giving scanners time to catch a poisoned release first.
The case for this cooldown delay ⬇️
github.blog
The case for a cooldown: Why Dependabot now waits before issuing version updates
A new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code.
