Dependabot now waits 3 days by default before proposing dependency updates

GitHub changed Dependabot's default behavior: version updates now sit in a three-day cooldown before a PR is opened, giving the ecosystem time to catch malicious or broken releases — while security patches still land immediately. Teams that want the old immediate behavior must opt out.

What it means A default-on cooldown is a supply-chain defense that reaches every repo using Dependabot — worth knowing whether you keep it or opt out.