LOWVulnerability
Global

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

·Source: The Hacker News

Updated:

Executive Summary

GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub, the

Analysis

GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub, the
Source Attribution

Originally published by The Hacker News on Jul 27, 2026.

Related Threats

MEDIUMVulnerabilityNEW

PNC Financial Services appoints CISO

The PNC Financial Services Group, Inc. (NYSE: PNC) announced today that Christian Winward has been named chief information security officer.

Finextra
MEDIUMVulnerabilityNEW

NVIDIA’s Open Secure AI Alliance Is Missing Some Big Names

NVIDIA has launched a new Open Secure AI Alliance to build an “open defense stack for agents”

Infosecurity Magazine
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-14516 — The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre...

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu

CVE-2026-14516
NIST NVD