The case for a cooldown: Why Dependabot now waits before issuing version updates
2026-07-23T19:23:26Z•6952e2888568a4db77bbb1039c2db1cb65d60ad20a4cc0cded111ec7a37b4c55
Advisory DatabaseDependabotGitHub Enterprise ServerLLM-assisted triagebug bountycooldownfalse positive reductiongit push pipelineincident responsemaintainer toolingremote code executionrepository ownershipsecret scanningsecurity settingssigning key rotationsupply-chain securityvulnerability disclosure
What happened
A collection of GitHub security posts (Apr–Jul 2026) covering product and program changes plus incident responses. Highlights include: Dependabot now applies a three-day cooldown before opening version-update PRs to give maintainers and researchers time to triage releases; restructuring and stricter quality/prioritization for the bug bounty program; a rapid response to a critical remote-code-execution vulnerability in the git-push pipeline (fixed and investigated within two hours, no confirmed exploitation); an urgent signing-key rotation for GitHub Enterprise Server customers; improvements to
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- github_security_blog
- Record identifier
- 6952e2888568a4db77bbb1039c2db1cb65d60ad20a4cc0cded111ec7a37b4c55
- Enrichment time
- 2026-07-23T19:23:26Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.