GitHub adds a three‑day cooldown for Dependabot pull requests, while PyPI blocks uploads to releases older than 14 days. Both measures aim to curb rapid propagation of malicious packages in the software supply chain.

Key Takeaways

  • Dependabot now waits three days after a release before opening a pull request.
  • PyPI rejects file uploads to releases that are older than 14 days.
  • The policies target fast‑moving supply‑chain attacks and protect long‑standing stable releases.

GitHub and the Python Package Index (PyPI) have rolled out new policies designed to boost supply‑chain security by preventing the swift spread of poisoned package versions and the poisoning of old, stable releases.

Policy Details

GitHub introduced a Dependabot cooldown. The automation now waits at least three days after a new release is published before creating a pull request, applying only to non‑security version bumps and configurable via dependabot.yml.

PyPI now blocks uploads to releases older than 14 days. This restriction mitigates the risk of compromised publishing tokens or workflows poisoning long‑standing releases.

Why This Matters

BozokMedia analysis shows that reducing the window for automated adoption of new code dramatically cuts the attack surface for supply‑chain threats, giving maintainers and security tools a critical buffer period.

"A three‑day cooldown pushes most supply‑chain attacks out of the fast‑track window," says a cybersecurity expert.

Historical Background

High‑profile supply‑chain incidents such as the 2021 SolarWinds breach and the 2023 PyPI token theft highlighted the need for faster detection and response mechanisms in open‑source ecosystems.

Did You Know?: Only 56 of the top 15,000 PyPI packages published a file more than 14 days after a release, meaning the new rule affects a tiny fraction of projects.

Frequently Asked Questions

Question 1: Does the Dependabot cooldown apply to all repositories?
Answer: Yes, but it can be customized in dependabot.yml.

Question 2: How will PyPI’s new rule affect existing users?
Answer: It only impacts users who attempt to upload new files to releases older than 14 days; the majority will be unaffected.